Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have an ASA5520 that is set up to send logs to a splunk syslog server. the setup works for a while, usually around 24 hours or so, but then stops until either the logging is reconfigured (twiddling the ports) or the ASA is restarted.

what should i be looking at to resolve this issue? im not sure if its the splunk syslog daemon ignoring connections or the ASA that gets messed up and stops sending.

id like to enable the 'dont pass traffic without logging working' option, but without a stable connection to syslog, thats a non starter.

tried so far: TCP and UDP, different ports, changing the logging level

share|improve this question

1 Answer 1

Put a packet sniffer on the Splunk host, set up a capture filter to capture only packets that originate from the ASA, start a capture, when splunk stops "seeing" data from the ASA look at the capture and see if traffic is still coming in from the ASA, if it is then the problem is with Splunk, if it's not then the problem is with the ASA or the network between the two.

share|improve this answer
    
this is totally the right answer, however in this installation i dont have permission to install a packet capture utility. –  Devnull Dec 7 '10 at 14:59
    
If you're able to and have the equipment, you could install a packet sniffer on an intermediary host and connect a hub between the 3 hosts (the hub is essentially acting as a network tap) or you could install a packet sniffer on an intermediary host and configure the switch to mirror traffic from the ASA connected port to the intermediary host connected port. –  joeqwerty Dec 7 '10 at 15:18

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.